Would you let an AI agent loose in your codebase at 2 a.m., unsupervised, with the keys to your internal systems?
Most teams would say no, and honestly, that is the right answer. But agents are already doing exactly that kind of work: fixing broken builds, testing releases, triaging alerts, and working through bug backlogs while everyone sleeps. The question is no longer whether agents get that kind of access. It is where they run while they have it.
On November 12, Anthropic gave teams a new answer: a private beta of self-hosted Claude Managed Agents, a version of its agent service that runs entirely inside the customer's own cloud or on their own servers.
The whole service moves home
Managed Agents is Anthropic's service for building long-running agents, the kind that work for hours instead of answering one message and stopping. Until now it ran as a hosted service, with Anthropic operating the infrastructure. The self-hosted version moves the whole thing: the agent harness, the sandboxes where code runs, the credentials, and the session history.
In practice, you operate three pieces: the Managed Agents server, its PostgreSQL database, and the workers where agents run their shell and file tools.
Think of it like moving a workshop into your own garage instead of renting space across town. Same tools, same work, but your locks are on the door and your rules are on the wall.
Photo by Paul Hanaoka on Unsplash
The brain and the hands are split
Anthropic built Managed Agents around a simple idea: the harness is the brain, the sandbox is the hands, and the two stay separate by design. The harness calls Claude and runs the agent loop. The sandbox is where the agent's code runs. Session history and vault secrets stay outside it, and a sandbox only starts when a tool needs one.
Credentials get the same treatment. They never sit inside the sandbox. For MCP tools and supported API calls, a proxy outside the sandbox adds the credential to the request, and you can keep those credentials in your own secrets manager.
Each environment can also be locked to a list of allowed hosts, so requests to any other host are blocked. For an agent that fixes broken builds, that list might be just your git host and your package registry. Every step an agent takes is logged, every tool call and what came back, exported over OpenTelemetry into the monitoring tools a team already runs.
The part worth reading twice
Here is the honest caveat, and it matters: the model does not move. Every model call still leaves your network. Claude itself still runs outside your walls, so prompts go out and completions come back. You choose where those requests go: to Anthropic directly, to Amazon Bedrock, Google's Agent Platform, Microsoft Foundry, or your own gateway. If your organization has a zero data retention agreement with Anthropic, it applies to those requests the same way as any other call to the Messages API.
There are other limits worth knowing. This is a private beta, and access goes through your Anthropic account team. There is no public pricing and no general-availability date. A few hosted features are missing on the self-hosted server for now, including scheduled deployments, dreams, and webhooks. The server, the database, and the firewall rules are now yours to run, which means patching them is your job too.
A pattern, not a one-off
Last week I wrote about Mistral Studio, which runs your AI agents for you. Anthropic just answered with a version that runs inside your own walls. Same direction: agents are moving closer to where the code and the secrets already live.
That makes sense to me. An agent you cannot see is a risk, and one you cannot control is a bigger one. Putting the harness, the history, and the credentials inside your own perimeter does not solve every problem, but it answers the first question a security team asks: where does this thing actually run?
So the interesting question is not whether agents will work inside our systems. They already do. The question is who holds the keys while they work, and whether the answer is you.
Top comments (0)